# Subprocessors The third-party services Shine engages to deliver the Services. We list every subprocessor that processes customer personal data, what it does, and where it operates. Mirrors the authoritative list at ; see [Security](https://www.shine.studio/security) for how these vendors are vetted. Shine gives customers at least 30 days’ notice before a new subprocessor begins processing customer personal data, by updating this page and by emailing each customer’s notice contact. Where we must replace a subprocessor urgently to protect the security or continuity of the Services, we give notice as soon as practicable. ## Infrastructure Hosting, storage, database, and sign-in services that run the Shine platform. - **Amazon Web Services (AWS)** — Application hosting, database, object storage, backups, video rendering. Location: United States. Data: All customer content and account data. - **Supabase** — Database and file storage for the interview recording surface. Location: United States. Data: Respondent names, emails, roles, companies, and headshot images; interview questions (including AI follow-ups) and transcripts; consent receipts (with IP address and user agent); recording metadata. - **Cloudflare** — DNS resolution only (no traffic proxying); bot protection (Turnstile) on sign-in and marketing-site forms. Location: Global edge network. Data: IP addresses and request metadata of people signing in or submitting site forms. - **Google (Sign-In and Places)** — Sign in with Google; business lookups for review links. Location: United States. Data: Workspace users’ name, email, and Google account ID at sign-in; company names (Places). - **Google Cloud Storage and jsDelivr** — Delivery of face-detection and blur model files to respondents’ browsers, and of Shine’s API documentation page. Location: Global edge network. Data: IP addresses and request metadata of respondents and visitors to Shine’s API documentation. ## Video & media Services that host, encode, and render recorded interview media. - **Mux** — Video upload, hosting, encoding, delivery, and playback analytics. Location: United States. Data: Interview video, video titles, and stream metadata; viewers’ IP addresses, browser details, and viewing activity. - **Shotstack** — Rendering of video clips from interview recordings. Location: Australia and United States. Data: Respondent video and audio; caption files (transcript excerpts); on-screen speaker name and role, and the customer’s logo and brand styling; rendering metadata. ## AI & transcription AI providers act only as our processors and may not train on customer content, under their commercial terms or an opt-out we set. - **Deepgram** — Speech-to-text transcription. Location: United States. Data: Interview audio, respondents’ practice answers, workspace users’ dictation audio, transcripts. - **OpenAI** — AI analysis and drafting: claim extraction, summaries, interview follow-up questions, the in-app assistant (Vera), company and brand profiles. Location: United States. Data: Transcripts and interview answers; respondent names, job titles, companies, and work emails; workspace users’ names, emails, and assistant messages; company website content and screenshots; derived text. - **Anthropic** — AI analysis and drafting: claim extraction, summaries, interview follow-up questions, the in-app assistant (Vera), company and brand profiles. Location: United States. Data: Transcripts and interview answers; respondent names, job titles, companies, and work emails; workspace users’ names, emails, and assistant messages; company website content and screenshots; derived text. - **Google (Gemini)** — AI analysis and drafting: claim extraction, summaries, interview follow-up questions, the in-app assistant (Vera), company and brand profiles; thumbnail selection. Location: United States. Data: Transcripts and interview answers; respondent names, job titles, companies, and work emails; workspace users’ names, emails, and assistant messages; company website content and screenshots; derived text; video frames of respondents (to choose thumbnails). - **ElevenLabs** — Spoken voice for the self-guided interviewer. Location: United States. Data: Interviewer question text (including AI follow-ups based on respondents’ answers) and generated audio; no respondent audio. - **Perplexity** — AI-visibility auditing (opt-in per workspace). Location: United States. Data: Brand and topic prompts only; no personal data. Listed for transparency. ## Enrichment & lookups Services that look up public company and professional information. - **People Data Labs** — Detection of job changes for respondents in a customer’s advocacy program; company profile enrichment. Location: United States. Data: Respondent email address; returned employer, title, work email, personal mobile number, and professional profile URL; company names and domains. Its contract limits how it may use Shine’s data. - **Firecrawl** — Company website lookups for brand and company profiles (where enabled). Location: United States. Data: Company domains (which may come from a respondent’s work-email domain); no other personal data. Listed for transparency. - **Brandfetch** — Company logo and brand lookups (where enabled). Location: Switzerland. Data: Company domains; no other personal data. Listed for transparency. - **SerpAPI** — AI-visibility search queries (where enabled). Location: United States. Data: Search queries; no personal data. Listed for transparency. ## Payments Reward and gift payouts. - **Tremendous** — Reward payouts to respondents; gifts to advocates. Location: United States. Data: Respondent names and payout status; advocates’ names and email addresses; optional gift messages. ## Communications Transactional email delivery. - **Resend** — Transactional email delivery. Location: United States. Data: Recipient email addresses and email content. ## Analytics & product telemetry Used to understand how the Shine application is used and to fix errors. - **PostHog** — Product analytics, session replay, and error tracking. Location: United States. Data: Workspace user identifiers and event metadata; session replays of the Shine web app, public story pages, and Shine’s internal admin tools, which can show names and quotes on screen; error traces; respondent email addresses (survey feature checks); company domains. ## Internal tooling & support Where in-app feedback, bug reports, and operational alerts are routed. - **GitHub** — Tracking of in-app feedback. Location: United States. Data: Feedback and bug-report text users submit, page URL with sensitive parameters redacted, browser details, pseudonymous user and workspace IDs. - **Slack** — Internal alerts and in-app feedback. Location: United States. Data: Feedback and bug-report text users submit, page URL with sensitive parameters redacted, pseudonymous user and workspace IDs; operational alerts with workspace users’ names, emails, and workspace names and, for payout failures, respondents’ names and emails. ## Shine’s own operations Services that run Shine’s marketing site, internal operations, and billing. - **Vercel** — Static hosting and edge delivery for the shine.studio marketing site. Location: United States. Data: No customer content. IP addresses and request metadata for the marketing site. - **Supabase (marketing site)** — Form and checkout handling for the shine.studio marketing site (waitlist, newsletter, quote, demo, security-package, ambassador and job-application forms, and checkout records). Location: United States. Data: Names, email addresses, company and message content submitted through site forms; job applicants’ résumés; billing contact and subscription status from checkout; referral and campaign attribution (UTM parameters, referrer, click IDs); IP addresses (rate limiting). - **Google Analytics 4** — Marketing-site visitor analytics. Location: United States. Data: IP-derived geography, page views, referrer, and aggregated session metrics. - **Microsoft Clarity** — Session replay and heatmap analytics for the marketing site. Location: United States. Data: Anonymized session recordings and click maps. - **Google Workspace (Sheets)** — Operational mirror of marketing-site contact submissions (waitlist, quote requests) for the sales team. Location: United States. Data: Marketing-contact details: name, email, company, and message content submitted via site forms. - **Stripe** — Subscription billing and customer payment processing. Location: United States. Data: Billing contact and payment tokens; Shine stores no card numbers. ## Systems you connect When you connect your own systems, such as your CRM (Salesforce or HubSpot), Slack workspace, LinkedIn or YouTube account, review sites (Trustpilot or G2) or a webhook, Shine sends data to them on your instruction. They are recipients you choose, not Shine subprocessors. ## Stay informed of changes Each customer’s notice contact is emailed. Anyone else can ask to be emailed about changes: email with the subject “Subprocessor Notifications”. Customers may object to a new subprocessor in writing, within the notice period, on reasonable, objective data-protection grounds. If we cannot accommodate the objection, you have the right to terminate the affected Services in accordance with your Data Processing Agreement. ## Data Processing Agreement Where Shine processes personal data on your behalf, our Data Processing Agreement (DPA), which incorporates the applicable Standard Contractual Clauses, forms part of our Terms of Service. For a copy, or a version countersigned by Shine, email . ## Questions Email for subprocessor change notifications, a copy of our DPA, or the security questionnaire.